29
May
Employer Asked Me To Hack Into Staff Members Email Accounts?
Author: admin // Category: videosI am the IT person within an organization. One of the ex-staff members is taking the organization to court. I was called into the CEO’s office to see if it was possible to discover any communication between staff members personal email accounts about the case. I was quite disturbed that they asked me to do this, where do I stand legally? Should this be reported?
Tags: Accounts, Asked, Email, Employer, Hack, Into, Members, Staff
May 29th, 2009 at 7:22 pm
Yeah, you can’t go on hacking people’s personal email accounts that have nothing to do with the company, and I would be clear to the CEO that anything you obtained in such an en devour would not only be inadmissible, but it would also likely open up some kind of liability. Also, get the company’s general counsel involved.
Now, if the person accessed their personal email on a company machine…any information captured by that machine is fair game. Same thing with company emails. Of course, you can’t use a saved password to log in to an account…but you can search through the machine for any dirty laundry.
May 29th, 2009 at 10:26 pm
From what I know, if they want you to look at old emails that where from the companies email address eg. [email protected] then that is legal, as it is and was the property of the company. You can even look at personal emails sent from that address.
However, if it is a personal email account, such as gmail or yahoo etc, then that is not legal and breaking privacy laws, even if they sent the email from gmail or yahoo using a company computer as the account did not belong to the company.
You want to be careful here as you do not want to get into legal trouble or get fired if you refuse to do something that is illegal.
If I were you, I would start writing down personal notes of when the meetings where and what was said with you regarding this matter. Then contact a lawyer on your own time to see what they advise you to do. Most lawyers will talk to you for free. You want to know what is legal and to protect yourself if the company goes after you for not following their orders.
Good luck. It’s a pickle to be in.
EDIT: rockpolisherc is wrong to say it is a felony to hack into a computer. It is if it does not belong to you, but if the emails came from a computer owned by the company and using the company email address and email program, then that is the PROPERTY of the company and the company can legally ask you to give them copies of those emails and anything else on that computer (web history etc). But you cannot hack into their gmail etc accounts.
May 30th, 2009 at 2:09 am
Wow. Dumb thing to be asked to do. Really puts you in a bad position doesn’t it? Well, first of all , you really ought to know that it is a felony to hack into any ones computer. Second, I would make up some lame excuse like ” they must have changed their password recently” which would maybe get the pressure off of you. Or , you could go to a public library, and send them a very discreet message telling them to change their password for security reasons maybe. Or perhaps a computer belonging to a friend that nobody in work would recognize. Something like that. Most of all , I would remove myself from being involved with the whole thing. Stay neutral
May 30th, 2009 at 6:00 am
if the email accounts are the companies own server then I don’t think your employer is out of line however I would talk to your HR before you do anything regardless of the server. A CEO should have access shouldn’t he? if it’s gets too tricky you may want to talk to your Dept of labor for legal advise.
May 30th, 2009 at 6:55 am
Here I make the assumption that by personal email, you mean a web mail account.
What you are being asked to do is illegal, skip ‘privacy’ its illegal. If the intention is to ‘hack’ an account on a public website, then he is inciting a violation and you could be held as an accessary. Whatever the CEO is being taken to court for must have them spooked enough to even contemplate these countermeasures.
However, as a security professional - there are options…
As most companies have network usage agreements in place so users expect no privacy for data passing over the “corporate network” private data or not - it would be a grey area for capturing data and then using it against the ex-employee, I would probably say that collecting any data that may be held in caches on the Corporate Proxy server, any Network Log files and the like, and even trawling though their business email accounts, looking for any information - this would be legal as the data is essentially owned by the company and would be set out by the network usage agreement - the very reason why they are created in the first place to reduce the risk to the business in these situations.
So reset the passwords on their accounts, log into the computers they used and check the caches - before you do any of this though - Ghost the computers and then only open the image on a NEW computer - you have ‘uncorrupted data’ once you log in it could be seen as the data has been manipulated etc and be inadmissable in court. Check any network logs that you have from the proxy server for those dates they were ‘around’ - The email server will retain any outgoing mail and any backups can recover historical data.
But these tasks are only for the data within the corporate network. Asking to secure access to any data outside of the scope of a network usage agreement ie. Local data is illegal.
Or you could just turn around and say - there’s no data to find and you’ve had a look - that way, you dodge the whole thing.